nisse-review: match repository patterns against Gitea's search

At bring-up, `dev/*` failed: listing an organization's repositories
(/orgs/dev/repos) needs the read:organization token scope, which the
reviewer's token doesn't have and shouldn't need. Patterns are now matched
against /repos/search, which needs only the repository scope and already
lists every repository the account can read. A pattern that matches
nothing is logged (access.no_match). owner_repositories goes.

A Gitea error at startup is now reported like a config error, not a
traceback.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Development-Plan.md

@@ -608,9 +608,9 @@ waits until two exist to compare. Moved, unchanged in behaviour:
   ready unless a draft or titled WIP; closed when the PR merges or closes.
   Every open PR is reviewed, those open when it starts included (operator).
   Since #153, `repositories` holds patterns (`dev/*`, `*/*`) matched against
-  every repository it can read, public ones included (Gitea's own list for the
-  account leaves out a public repository's Read collaborators, found at
-  bring-up); the read-only wall is checked every round, not only at startup.
+  every repository it can read, public ones included, through Gitea's search
+  (`/repos/search`, which needs no `read:organization` scope); the read-only wall
+  is checked every round, not only at startup.
 - **Reading (R3):** the repository at the PR's head and base, from Gitea's
   archives, unpacked into a scratch folder and read in Python (`read_file`,
   `list_files`, `search_code`), and its issues (`read_issue`,